1008-00009 · Lumos Analytics Inc · Correspondence

response-to-garrison-oakley-demand-letter.docx DOCUMENT Data Privacy

6 / 12 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 982-7600 Facsimile: (415) 982-7601 www.calderwoodharkness.com

Privacy & Data Security Practice Group

September 12, 2024

Via First-Class U.S. Mail and Electronic Mail

Garrison & Oakley LLP 1500 Market Street, Suite 3200 Philadelphia, PA 19102

Re: Response to Pre-Litigation Demand Letter Dated August 28, 2024, on Behalf of Unnamed Putative Class of Users of the Lumos Insight Platform

C&H Matter No.: 1008-00009

Dear Counsel:

We write on behalf of our client, Lumos Analytics Inc. ("Lumos" or the "Company"), in connection with the matters referenced in your pre-litigation demand letter dated August 28, 2024 (the "Demand Letter"). We acknowledge receipt of the Demand Letter, which was sent on behalf of an unnamed putative class of individuals alleged to have been affected by a security incident involving the Lumos Insight Platform (the "Platform"). As we understand it, the Demand Letter purports to demand that Lumos enter into pre-suit settlement discussions related to the credential-stuffing incident that occurred in June 2024 (the "Incident"). This letter sets forth Lumos's position with respect to the Demand Letter and the claims suggested therein.

I. Lumos's Prompt and Comprehensive Response to the Incident

Without waiving any privilege, objection, or defense, and without conceding any of the characterizations, assertions, or legal conclusions set forth in the Demand Letter, we provide the following factual context. The information set forth below is based solely on information that has already been made publicly available through Lumos's breach notification program, and nothing herein should be construed as a disclosure of any privileged, confidential, or otherwise protected information.

In June 2024, Lumos detected unauthorized login activity on the Platform involving the use of compromised credential pairs — that is, username-and-password combinations — obtained from an unrelated third-party data breach that did not involve Lumos, its systems, or its infrastructure. In other words, the threat actors utilized credentials that had been exposed as a result of a security incident at an entirely separate and unaffiliated organization, and attempted to use those same credential pairs to access Lumos Insight Platform accounts where users had reused the same passwords.

Upon detection of this unauthorized activity, Lumos immediately implemented a series of containment measures designed to halt the unauthorized access and protect its users. These measures included, among other things, the execution of a global password reset for all Platform user accounts, the identification and blocking of all offending IP addresses and address ranges associated with the unauthorized login attempts, and the suspension of any accounts exhibiting indicators of unauthorized access pending verification by the account holders.

Lumos promptly engaged experienced digital forensics professionals to conduct a thorough and independent investigation into the nature, scope, and impact of the Incident. The forensic investigation, which included a comprehensive analysis of server logs, network traffic data, database access records, and system configurations, confirmed the following key findings:

• There was no evidence of bulk data exfiltration from any account that was accessed during the Incident. While a limited number of accounts were accessed using valid credentials, the investigation found no indication that data was downloaded, copied, transferred, or otherwise exfiltrated in any systematic or automated fashion.

• There was no evidence of malware deployment on any Lumos system, server, endpoint, or infrastructure component. The threat actors did not install any backdoors, remote access tools, ransomware, keyloggers, or other malicious software.

• There was no evidence of compromise of Lumos's internal systems, databases, or infrastructure. The Incident was confined to the authentication layer of the Platform. The threat actors did not gain access to Lumos's backend databases, administrative consoles, source code repositories, or any other internal systems.

• All unauthorized access was accomplished exclusively through the use of valid user credentials obtained from a source wholly external to Lumos. There was no exploitation of any vulnerability in the Platform's code, architecture, or security controls, and no indication that any Lumos employee, contractor, or agent was involved in or facilitated the unauthorized access.

These forensic findings are significant, and they fundamentally undermine the characterizations and claims suggested in the Demand Letter. The Incident was not the result of any failure on Lumos's part to secure its systems, but rather the consequence of credential reuse by certain users who employed the same passwords across multiple, unrelated online services.

II. Full Compliance with All Applicable Breach Notification Obligations

Notwithstanding the limited nature of the Incident and the absence of evidence of data exfiltration, Lumos has fully complied with all applicable federal, state, and territorial breach notification statutes. Lumos undertook an expansive notification program that exceeded the requirements of the most restrictive jurisdictions implicated by the Incident.

Specifically, individual breach notification letters were sent to all 11,438 individuals identified as having been affected by the Incident. These notifications were delivered both via electronic mail and, where the affected individual's email address was unavailable, undeliverable, or where applicable law required physical notice, via U.S. mail to the individual's last known residential address. Each notification letter included a clear and concise description of the Incident, a description of the categories of information potentially at risk, a description of the remediation measures taken by Lumos, information regarding the complimentary credit monitoring and identity theft protection services being offered, and contact information for Lumos's dedicated incident response team.

Notifications were filed with the offices of the Attorneys General in all states where such notification was required under applicable state breach notification statutes. In total, Lumos submitted notifications to thirty-four (34) state Attorneys General offices, each in compliance with the specific formatting, content, and timing requirements of the applicable state's law. All such notifications were submitted within the applicable statutory deadlines, and in most cases well in advance of those deadlines.

In addition, because a subset of the affected individuals were located in the United Kingdom and the European Union, Lumos made timely notification to the United Kingdom Information Commissioner's Office ("ICO") within the required seventy-two (72) hour window under Article 33 of the United Kingdom General Data Protection Regulation ("UK GDPR"). Individual notices were also sent to all affected UK and EU data subjects in accordance with Article 34 of the UK GDPR and the corresponding provisions of the EU GDPR, as applicable.

All notifications — to individuals, to state Attorneys General, and to international data protection authorities — were completed well within the most restrictive statutory deadlines applicable to the Incident. Lumos's notification program was conducted transparently, expeditiously, and in full compliance with the law.

III. Remediation Measures and Credit Monitoring

In addition to its prompt containment and notification efforts, Lumos has undertaken comprehensive remediation measures designed to strengthen the security of the Platform and to reduce the risk of similar incidents in the future. These measures include, but are not limited to, the following:

• Mandatory Multi-Factor Authentication. Lumos has implemented mandatory multi-factor authentication ("MFA") for all Insight Platform user accounts. All users are now required to authenticate using a second factor — such as a time-based one-time password, a push notification to a registered mobile device, or a hardware security key — in addition to their username and password. This measure significantly reduces the risk posed by credential-stuffing attacks, as compromised credentials alone are no longer sufficient to access an account.

• Advanced Bot-Detection and CAPTCHA Technology. Lumos has deployed advanced bot-detection and CAPTCHA technology on all authentication endpoints of the Platform. These tools are designed to distinguish automated login attempts from legitimate human users and to block or challenge suspicious traffic in real time.

• Reduced Rate-Limiting Thresholds. Lumos has significantly reduced the rate-limiting thresholds on all login endpoints, thereby restricting the number of authentication attempts that can be made from a single IP address or device within a given time period. This measure is designed to frustrate the high-volume, automated login attempts that are characteristic of credential-stuffing attacks.

• Permanent Disabling of Quick View Cached Data Feature. Lumos has permanently disabled the Quick View cached data feature of the Platform. This feature, which previously allowed users to access a cached summary of certain account data without full re-authentication, has been removed entirely to eliminate a potential vector for unauthorized data access.

• Credential-Screening Service Integration. Lumos has integrated a credential-screening service that automatically checks user passwords against known breach databases at the time of login and at the time of any password change. Users whose passwords are found to match credentials in known breach databases are prompted to select a new, unique password before being permitted to proceed.

These measures reflect Lumos's commitment to the security of its users and the ongoing protection of the data entrusted to the Platform.

Furthermore, Lumos has offered all 11,438 affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Sentinel Identity Services, Inc. These services include daily credit report monitoring across all three major credit bureaus, real-time alerts for suspicious activity, identity theft insurance coverage, and access to a dedicated fraud resolution team. These services are provided at no cost to the affected individuals, and enrollment information was included in each individual notification letter.

IV. Declination of Pre-Suit Settlement Discussions

In light of the foregoing — including Lumos's prompt detection and containment of the Incident, the forensic finding of no evidence of data exfiltration from any accessed account, Lumos's full compliance with all applicable notification obligations across thirty-four states and international jurisdictions, and the comprehensive remediation and credit monitoring measures that Lumos has voluntarily undertaken — Lumos respectfully declines to engage in the pre-suit settlement discussions proposed in the Demand Letter dated August 28, 2024.

Lumos does not believe that the facts, as established by the forensic investigation and as reflected in Lumos's public notifications, support the claims and legal theories suggested in the Demand Letter. The Incident resulted from the exploitation of credentials compromised in an unrelated third-party breach, not from any deficiency in Lumos's security practices. Lumos responded to the Incident swiftly, transparently, and in full compliance with the law, and has taken significant steps to remediate and to protect its users going forward. Under these circumstances, Lumos sees no basis for the pre-litigation settlement discussions that your firm has proposed.

V. Reservation of Rights

This letter is provided for informational purposes only and in direct response to the Demand Letter. Nothing in this letter constitutes, nor shall it be construed as constituting, an admission of any liability, fault, wrongdoing, or violation of any statute, regulation, contractual provision, common law duty, or other legal obligation by Lumos Analytics Inc. or any of its past or present officers, directors, employees, agents, affiliates, subsidiaries, or representatives.

Lumos expressly reserves all rights, claims, and defenses available to it at law and in equity, including but not limited to all procedural, substantive, and affirmative defenses that may be available in connection with any claim, demand, action, or proceeding arising out of or related to the Incident, the Demand Letter, or the subject matter of this correspondence. Such defenses include, without limitation, defenses relating to standing, injury-in-fact, causation, class certification, statute of limitations, preemption, failure to state a claim, and any and all other defenses that may be applicable.

Nothing in this letter shall be construed as a waiver of the attorney-client privilege, the work product doctrine, the common interest privilege, or any other applicable privilege, immunity, or protection. To the extent that any statement in this letter could be interpreted as disclosing privileged or protected information, such disclosure is inadvertent and does not constitute a waiver of any privilege or protection.

Lumos does not waive, and expressly preserves, any objection to jurisdiction, venue, standing, class certification, or any other procedural or substantive defense by virtue of this correspondence or any prior or subsequent communication with your firm.

Lumos reserves the right to supplement, amend, clarify, or withdraw any statement made herein at any time and without prior notice.

VI. Future Communications

We respectfully request that any and all future correspondence, communications, or service of process regarding this matter or any related matter be directed solely to the undersigned at the address below, and not to Lumos Analytics Inc. or any of its officers, directors, or employees directly:

Rachel Bernstein, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, CA 94111 Telephone: (415) 982-7644

Email: r.bernstein@calderwoodharkness.com

We trust that your firm will honor this request and direct all future communications to this office.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Rachel Bernstein Partner, Privacy & Data Security Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, CA 94111 Direct: (415) 982-7644

Email: r.bernstein@calderwoodharkness.com

cc: Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc. (via email — privileged and confidential)

cc: Kevin Ostrowski, Partner, Calderwood & Harkness LLP (internal)

cc: Sara Hendricks, Associate, Calderwood & Harkness LLP (internal)

CALDERWOOD & HARKNESS LLP Attorneys at Law
One Embarcadero Center, Suite 3400 San Francisco, California 94111 Telephone: (415) 982-7600 Facsimile: (415) 982-7601 www.calderwoodharkness.com
Privacy & Data Security Practice Group
September 12, 2024
Via First-Class U.S. Mail and Electronic Mail
Garrison & Oakley LLP 1500 Market Street, Suite 3200 Philadelphia, PA 19102
Re: Response to Pre-Litigation Demand Letter Dated August 28, 2024, on Behalf of Unnamed Putative Class of Users of the Lumos Insight Platform
C&H Matter No.: 1008-00009
Dear Counsel:
We write on behalf of our client, Lumos Analytics Inc. ("Lumos" or the "Company"), in connection with the matters referenced in your pre-litigation demand letter dated August 28, 2024 (the "Demand Letter"). We acknowledge receipt of the Demand Letter, which was sent on behalf of an unnamed putative class of individuals alleged to have been affected by a security incident involving the Lumos Insight Platform (the "Platform"). As we understand it, the Demand Letter purports to demand that Lumos enter into pre-suit settlement discussions related to the credential-stuffing incident that occurred in June 2024 (the "Incident"). This letter sets forth Lumos's position with respect to the Demand Letter and the claims suggested therein.
I. Lumos's Prompt and Comprehensive Response to the Incident
Without waiving any privilege, objection, or defense, and without conceding any of the characterizations, assertions, or legal conclusions set forth in the Demand Letter, we provide the following factual context. The information set forth below is based solely on information that has already been made publicly available through Lumos's breach notification program, and nothing herein should be construed as a disclosure of any privileged, confidential, or otherwise protected information.
In June 2024, Lumos detected unauthorized login activity on the Platform involving the use of compromised credential pairs — that is, username-and-password combinations — obtained from an unrelated third-party data breach that did not involve Lumos, its systems, or its infrastructure. In other words, the threat actors utilized credentials that had been exposed as a result of a security incident at an entirely separate and unaffiliated organization, and attempted to use those same credential pairs to access Lumos Insight Platform accounts where users had reused the same passwords.
Upon detection of this unauthorized activity, Lumos immediately implemented a series of containment measures designed to halt the unauthorized access and protect its users. These measures included, among other things, the execution of a global password reset for all Platform user accounts, the identification and blocking of all offending IP addresses and address ranges associated with the unauthorized login attempts, and the suspension of any accounts exhibiting indicators of unauthorized access pending verification by the account holders.
Lumos promptly engaged experienced digital forensics professionals to conduct a thorough and independent investigation into the nature, scope, and impact of the Incident. The forensic investigation, which included a comprehensive analysis of server logs, network traffic data, database access records, and system configurations, confirmed the following key findings:
• There was no evidence of bulk data exfiltration from any account that was accessed during the Incident. While a limited number of accounts were accessed using valid credentials, the investigation found no indication that data was downloaded, copied, transferred, or otherwise exfiltrated in any systematic or automated fashion.
• There was no evidence of malware deployment on any Lumos system, server, endpoint, or infrastructure component. The threat actors did not install any backdoors, remote access tools, ransomware, keyloggers, or other malicious software.
• There was no evidence of compromise of Lumos's internal systems, databases, or infrastructure. The Incident was confined to the authentication layer of the Platform. The threat actors did not gain access to Lumos's backend databases, administrative consoles, source code repositories, or any other internal systems.
• All unauthorized access was accomplished exclusively through the use of valid user credentials obtained from a source wholly external to Lumos. There was no exploitation of any vulnerability in the Platform's code, architecture, or security controls, and no indication that any Lumos employee, contractor, or agent was involved in or facilitated the unauthorized access.
These forensic findings are significant, and they fundamentally undermine the characterizations and claims suggested in the Demand Letter. The Incident was not the result of any failure on Lumos's part to secure its systems, but rather the consequence of credential reuse by certain users who employed the same passwords across multiple, unrelated online services.
II. Full Compliance with All Applicable Breach Notification Obligations
Notwithstanding the limited nature of the Incident and the absence of evidence of data exfiltration, Lumos has fully complied with all applicable federal, state, and territorial breach notification statutes. Lumos undertook an expansive notification program that exceeded the requirements of the most restrictive jurisdictions implicated by the Incident.
Specifically, individual breach notification letters were sent to all 11,438 individuals identified as having been affected by the Incident. These notifications were delivered both via electronic mail and, where the affected individual's email address was unavailable, undeliverable, or where applicable law required physical notice, via U.S. mail to the individual's last known residential address. Each notification letter included a clear and concise description of the Incident, a description of the categories of information potentially at risk, a description of the remediation measures taken by Lumos, information regarding the complimentary credit monitoring and identity theft protection services being offered, and contact information for Lumos's dedicated incident response team.
Notifications were filed with the offices of the Attorneys General in all states where such notification was required under applicable state breach notification statutes. In total, Lumos submitted notifications to thirty-four (34) state Attorneys General offices, each in compliance with the specific formatting, content, and timing requirements of the applicable state's law. All such notifications were submitted within the applicable statutory deadlines, and in most cases well in advance of those deadlines.
In addition, because a subset of the affected individuals were located in the United Kingdom and the European Union, Lumos made timely notification to the United Kingdom Information Commissioner's Office ("ICO") within the required seventy-two (72) hour window under Article 33 of the United Kingdom General Data Protection Regulation ("UK GDPR"). Individual notices were also sent to all affected UK and EU data subjects in accordance with Article 34 of the UK GDPR and the corresponding provisions of the EU GDPR, as applicable.
All notifications — to individuals, to state Attorneys General, and to international data protection authorities — were completed well within the most restrictive statutory deadlines applicable to the Incident. Lumos's notification program was conducted transparently, expeditiously, and in full compliance with the law.
III. Remediation Measures and Credit Monitoring
In addition to its prompt containment and notification efforts, Lumos has undertaken comprehensive remediation measures designed to strengthen the security of the Platform and to reduce the risk of similar incidents in the future. These measures include, but are not limited to, the following:
• Mandatory Multi-Factor Authentication. Lumos has implemented mandatory multi-factor authentication ("MFA") for all Insight Platform user accounts. All users are now required to authenticate using a second factor — such as a time-based one-time password, a push notification to a registered mobile device, or a hardware security key — in addition to their username and password. This measure significantly reduces the risk posed by credential-stuffing attacks, as compromised credentials alone are no longer sufficient to access an account.
• Advanced Bot-Detection and CAPTCHA Technology. Lumos has deployed advanced bot-detection and CAPTCHA technology on all authentication endpoints of the Platform. These tools are designed to distinguish automated login attempts from legitimate human users and to block or challenge suspicious traffic in real time.
• Reduced Rate-Limiting Thresholds. Lumos has significantly reduced the rate-limiting thresholds on all login endpoints, thereby restricting the number of authentication attempts that can be made from a single IP address or device within a given time period. This measure is designed to frustrate the high-volume, automated login attempts that are characteristic of credential-stuffing attacks.
• Permanent Disabling of Quick View Cached Data Feature. Lumos has permanently disabled the Quick View cached data feature of the Platform. This feature, which previously allowed users to access a cached summary of certain account data without full re-authentication, has been removed entirely to eliminate a potential vector for unauthorized data access.
• Credential-Screening Service Integration. Lumos has integrated a credential-screening service that automatically checks user passwords against known breach databases at the time of login and at the time of any password change. Users whose passwords are found to match credentials in known breach databases are prompted to select a new, unique password before being permitted to proceed.
These measures reflect Lumos's commitment to the security of its users and the ongoing protection of the data entrusted to the Platform.
Furthermore, Lumos has offered all 11,438 affected individuals twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Sentinel Identity Services, Inc. These services include daily credit report monitoring across all three major credit bureaus, real-time alerts for suspicious activity, identity theft insurance coverage, and access to a dedicated fraud resolution team. These services are provided at no cost to the affected individuals, and enrollment information was included in each individual notification letter.
IV. Declination of Pre-Suit Settlement Discussions
In light of the foregoing — including Lumos's prompt detection and containment of the Incident, the forensic finding of no evidence of data exfiltration from any accessed account, Lumos's full compliance with all applicable notification obligations across thirty-four states and international jurisdictions, and the comprehensive remediation and credit monitoring measures that Lumos has voluntarily undertaken — Lumos respectfully declines to engage in the pre-suit settlement discussions proposed in the Demand Letter dated August 28, 2024.
Lumos does not believe that the facts, as established by the forensic investigation and as reflected in Lumos's public notifications, support the claims and legal theories suggested in the Demand Letter. The Incident resulted from the exploitation of credentials compromised in an unrelated third-party breach, not from any deficiency in Lumos's security practices. Lumos responded to the Incident swiftly, transparently, and in full compliance with the law, and has taken significant steps to remediate and to protect its users going forward. Under these circumstances, Lumos sees no basis for the pre-litigation settlement discussions that your firm has proposed.
V. Reservation of Rights
This letter is provided for informational purposes only and in direct response to the Demand Letter. Nothing in this letter constitutes, nor shall it be construed as constituting, an admission of any liability, fault, wrongdoing, or violation of any statute, regulation, contractual provision, common law duty, or other legal obligation by Lumos Analytics Inc. or any of its past or present officers, directors, employees, agents, affiliates, subsidiaries, or representatives.
Lumos expressly reserves all rights, claims, and defenses available to it at law and in equity, including but not limited to all procedural, substantive, and affirmative defenses that may be available in connection with any claim, demand, action, or proceeding arising out of or related to the Incident, the Demand Letter, or the subject matter of this correspondence. Such defenses include, without limitation, defenses relating to standing, injury-in-fact, causation, class certification, statute of limitations, preemption, failure to state a claim, and any and all other defenses that may be applicable.
Nothing in this letter shall be construed as a waiver of the attorney-client privilege, the work product doctrine, the common interest privilege, or any other applicable privilege, immunity, or protection. To the extent that any statement in this letter could be interpreted as disclosing privileged or protected information, such disclosure is inadvertent and does not constitute a waiver of any privilege or protection.
Lumos does not waive, and expressly preserves, any objection to jurisdiction, venue, standing, class certification, or any other procedural or substantive defense by virtue of this correspondence or any prior or subsequent communication with your firm.
Lumos reserves the right to supplement, amend, clarify, or withdraw any statement made herein at any time and without prior notice.
VI. Future Communications
We respectfully request that any and all future correspondence, communications, or service of process regarding this matter or any related matter be directed solely to the undersigned at the address below, and not to Lumos Analytics Inc. or any of its officers, directors, or employees directly:
Rachel Bernstein, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, CA 94111 Telephone: (415) 982-7644
Email: r.bernstein@calderwoodharkness.com
We trust that your firm will honor this request and direct all future communications to this office.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Rachel Bernstein Partner, Privacy & Data Security Calderwood & Harkness LLP One Embarcadero Center, Suite 3400 San Francisco, CA 94111 Direct: (415) 982-7644
Email: r.bernstein@calderwoodharkness.com
cc: Allison Cho, General Counsel & Chief Privacy Officer, Lumos Analytics Inc. (via email — privileged and confidential)
cc: Kevin Ostrowski, Partner, Calderwood & Harkness LLP (internal)
cc: Sara Hendricks, Associate, Calderwood & Harkness LLP (internal)

CALDERWOOD & HARKNESS LLP Attorneys at Law

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts